What is Botnet

Botnet is a network of Internet-connected devices that are infected by a common kind of malware. Mainly used for sending spam emails and for denial of service attacks, these malicious actions often remain unknown to the users, as these devices are controlled remotely.

How Does Botnet Work?

A bot is a system affected by the malware, controlled by the cyber attacker. Bot malware looks out for the vulnerable device in a network instead of targeting one, with the aim to infect as many connected devices. The computing power of these devices is then used by the attacker for other automated tasks.

For example, ad fraud botnet targets web browser and directs traffic to certain online advertisements.

The botnet takes only partial control of the browser, as gaining full control will alert the user. These malware, so run in the background and works to create traffic in the targeted advertisements from the affected systems. A fraction of the bandwidth acquired from a device may not always be of much help to a cybercriminal, but a botnet combining millions of computers can create a large amount of fake traffic.

Botnet Architecture

Spread through malware such as trojan horse, botnets scan for vulnerabilities, and outdated software that haven’t been patched for its functioning. Botnets aim to infect the maximum number of devices. There are two ways of controlling bots, once the desired number of devices is attacked.

Client/Server Approach: Here, commands are sent to the infected devices through a communication protocol. This also involves setting up of a command and control server. Bots turn active only when they receive the message from the command and control server.

Peer To Peer: This is a decentralized approach in controlling bots in a peer to peer network. The bots scan the affected devices for malicious websites and then share, the updated versions of the malware. This is the recent day approach, as it gives cyber criminals the advantage of avoiding detection.

Notable Botnet Attacks

Zeus:  This is one of the mostly used malware and was first detected in 2007. This uses a Trojan horse to infect vulnerable services. This was initially used to steal banking credentials and such sensitive data from user’s device. After the data collection, bots were used to send spam and phishing e-mails to people, thus spreading the Zeus Trojan again.

Srizbi: Discovered in 2007, it was then the largest botnet in the world. It was responsible for sending a large amount of spam email over the internet. Srizbi made use of Trojans to infect computers and send out spams.It had affected around 450000 systems.

Mirai: Detected in 2016, Mirai was behind a number of distributed denial of service attacks. It scanned the network for vulnerable devices and avoided IP address belonging to a number of corporations. Since many devices that have been infected were able to function normally, it made detection of this botnet a very difficult task.